In short: Cisco Secure Client licensing has three options. Advantage (formerly AnyConnect Plus) and Premier (formerly AnyConnect Apex) are licensed per unique user; Premier adds posture, the Network Visibility Module, next-generation encryption, SAML and the management VPN tunnel. VPN Only is a perpetual licence counted on concurrent connections for one headend and cannot be combined with the others.
The three Secure Client licences
| Advantage | Premier | VPN Only | |
|---|---|---|---|
| Former name | AnyConnect Plus | AnyConnect Apex | AnyConnect VPN Only |
| Counted on | Unique users | Unique users | Concurrent connections on one headend |
| Purchase model | Term subscription or perpetual | Term subscription | Perpetual |
| Remote access VPN (desktop and mobile, per-app VPN, IKEv2) | Yes | Yes | Yes |
| Trusted network detection | Yes | Yes | Not listed |
| Network Access Manager (802.1X supplicant) | Yes | Yes | No |
| Umbrella roaming and Secure Endpoint enabler | Yes | Yes | No Umbrella roaming |
| FIPS compliance | Yes | Yes | Yes |
| Secure Firewall Posture (formerly HostScan) | No | Yes | Basic posture with ASA |
| ISE posture and unified compliance | No | Yes | No |
| Next-generation encryption (Suite B) | No | Yes | Yes |
| SAML authentication | No | Yes | Yes |
| Network Visibility Module | No | Yes | No |
| Management VPN tunnel | No | Yes | No |
| ASA multiple-context remote access | No | Yes | No |
Premier includes everything in Advantage. The feature split above is summarised from Cisco's Secure Client ordering guide; Cisco revises it from time to time, so we confirm it against the current guide when we quote.
Per-user vs concurrent licensing
Advantage and Premier count unique users: everyone who is authorised to use the service, regardless of how many devices they have or how often they connect. Because they are counted on people rather than on a particular firewall, they suit estates with several ASA or Threat Defense headends. Cisco's minimum order is 25 users.
VPN Only counts concurrent connections on a single headend. It suits a small, stable estate with one firewall and many occasional users, where peak simultaneous sessions are much lower than the user count. The restrictions are significant:
- It cannot be combined with Advantage, Premier or older AnyConnect licences
- It cannot be transferred, shared or split between devices; Cisco's guide ties it to a specific ASA
- It leaves out Umbrella roaming, ISE posture, the Network Visibility Module and Network Access Manager
For most organisations with more than one headend, or any plan to use zero trust, posture or roaming security, Advantage or Premier is the safer choice.
Term subscriptions and perpetual licences
- Subscriptions (Advantage and Premier) run from 12 to 60 months, with 36 months as Cisco's default, and include software updates and support for the whole term
- Perpetual Advantage and VPN Only licences need a separate software support contract to download new releases and get support
- Premier is sold as a subscription
- Licences are managed through your Cisco Smart Account; see our Cisco security licensing guide for how Smart Licensing works
The support contract matters more than it used to. Cisco's AnyConnect end-of-life notice only lets perpetual licence holders move to Secure Client at no charge if their support is active.
Which Secure Client licence do you need?
| If you need | Choose |
|---|---|
| Remote access VPN for staff, with MFA via RADIUS or Duo | Advantage |
| Umbrella or Secure Access roaming protection from the same agent | Advantage (or the entitlement that comes with those services) |
| Posture checks before VPN access, ISE posture, or SAML sign-in to the VPN | Premier |
| Endpoint flow telemetry for Splunk, Secure Network Analytics or XDR | Premier (Network Visibility Module) |
| An always-on management tunnel so IT can reach devices before users sign in | Premier |
| One firewall, occasional VPN users and nothing else | VPN Only |
Remember the other licences around Secure Client. Firewall licences do not include remote access VPN users, so you buy Secure Client alongside your Secure Firewall licences. ISE posture needs ISE Premier as well as Secure Client Premier. Cisco includes Secure Client at no extra charge for the modules used by some services, such as Cisco Umbrella and Secure Endpoint, and if you use Cisco Secure Access, check that entitlement with us before buying separate licences.
Headends and registration
Secure Client licences cover Cisco's VPN headends, but registration differs:
- Secure Firewall Threat Defense: licences are held in the same Smart Account as the firewall and enabled from Management Center or Device Manager
- Secure Firewall ASA: Advantage and Premier can be registered to physical ASAs; ASA virtual does not register them that way, but still needs a valid entitlement
- Cisco IOS routers also need a router security licence alongside Secure Client
- ISE and Meraki MX do not need registration, but users still need a contract entitlement for downloads and support
We check your Smart Account, match licences to headends and users, and co-term renewals. Pricing depends on licence type, quantity and term, so ask us for a quote and contact us with your user numbers and headends.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Secure Client Advantage and Premier?
Advantage covers VPN, the 802.1X supplicant, trusted network detection and Umbrella roaming. Premier adds Secure Firewall and ISE posture, the Network Visibility Module, next-generation encryption, SAML authentication, ASA multiple-context remote access and the management VPN tunnel.
Is Cisco Secure Client licensed per user or per device?
Advantage and Premier are licensed per unique user, whatever the number of devices. VPN Only is licensed per concurrent connection on a single headend.
Can I mix VPN Only with Advantage or Premier?
No. Cisco's ordering guide says VPN Only cannot be combined with Advantage, Premier or earlier AnyConnect licences, and VPN Only licences cannot be transferred or shared.
Is AnyConnect Apex the same as Secure Client Premier?
Yes. AnyConnect Apex was renamed Secure Client Premier, AnyConnect Plus became Secure Client Advantage, and AnyConnect VPN Only became Secure Client VPN Only.
Does my Cisco firewall licence include AnyConnect or Secure Client?
No. Remote access VPN users need Secure Client licences in addition to your firewall licences. Ask us for a quote for both together.